300-715 · Question #142
An administrator needs to give the same level of access to the network devices when users are logging into them using TACACS+. However, the administrator must restrict certain commands based on one…
The correct answer is A. Create one shell profile and multiple command sets. In Cisco ISE for TACACS+ device administration, shell profiles define the privilege level and session parameters (i.e., the 'level of access' to the device), while command sets define which specific commands a user is permitted or denied. Since all three roles need the same…
Question
An administrator needs to give the same level of access to the network devices when users are logging into them using TACACS+. However, the administrator must restrict certain commands based on one of three user roles that require different commands. How is this accomplished without creating too many objects using Cisco ISE?
Options
- ACreate one shell profile and multiple command sets.
- BCreate multiple shell profiles and multiple command sets.
- CCreate one shell profile and one command set.
- DCreate multiple shell profiles and one command set
How the community answered
(29 responses)- A72% (21)
- B3% (1)
- C7% (2)
- D17% (5)
Explanation
In Cisco ISE for TACACS+ device administration, shell profiles define the privilege level and session parameters (i.e., the 'level of access' to the device), while command sets define which specific commands a user is permitted or denied. Since all three roles need the same privilege level, only one shell profile is needed. However, because each role requires different command restrictions, multiple command sets (one per role) are required. Creating one shell profile and multiple command sets achieves the goal with minimal object overhead-avoiding the duplication that would result from creating multiple shell profiles.
Topics
Community Discussion
No community discussion yet for this question.